Carrie Roberts
1bfefdacfc
* provide elevation_required attribute * provide elevation_required attribute * provide elevation_required attribute
75 lines
2.1 KiB
YAML
75 lines
2.1 KiB
YAML
---
|
|
attack_technique: T1040
|
|
display_name: Network Sniffing
|
|
|
|
atomic_tests:
|
|
- name: Packet Capture Linux
|
|
description: |
|
|
Perform a PCAP. Wireshark will be required for tshark. TCPdump may already be installed.
|
|
supported_platforms:
|
|
- linux
|
|
input_arguments:
|
|
interface:
|
|
description: Specify interface to perform PCAP on.
|
|
type: String
|
|
default: ens33
|
|
executor:
|
|
name: bash
|
|
elevation_required: true
|
|
command: |
|
|
tcpdump -c 5 -nnni #{interface}
|
|
tshark -c 5 -i #{interface}
|
|
|
|
- name: Packet Capture MacOS
|
|
description: |
|
|
Perform a PCAP on MacOS. This will require Wireshark/tshark to be installed. TCPdump may already be installed.
|
|
supported_platforms:
|
|
- macos
|
|
input_arguments:
|
|
interface:
|
|
description: Specify interface to perform PCAP on.
|
|
type: String
|
|
default: en0A
|
|
executor:
|
|
name: bash
|
|
elevation_required: true
|
|
command: |
|
|
tcpdump -c 5 -nnni #{interface}
|
|
tshark -c 5 -i #{interface}
|
|
|
|
- name: Packet Capture Windows Command Prompt
|
|
description: |
|
|
Perform a packet capture using the windows command prompt. This will require a host that has Wireshark/Tshark
|
|
installed, along with WinPCAP. Windump will require the windump executable.
|
|
supported_platforms:
|
|
- windows
|
|
input_arguments:
|
|
interface:
|
|
description: Specify interface to perform PCAP on.
|
|
type: String
|
|
default: Ethernet0
|
|
executor:
|
|
name: command_prompt
|
|
elevation_required: true
|
|
command: |
|
|
c:\Program Files\Wireshark\tshark.exe -i #{interface} -c 5
|
|
c:\windump.exe
|
|
|
|
- name: Packet Capture PowerShell
|
|
description: |
|
|
Perform a packet capture using PowerShell with windump or tshark. This will require a host that has Wireshark/Tshark
|
|
installed, along with WinPCAP. Windump will require the windump executable.
|
|
supported_platforms:
|
|
- windows
|
|
input_arguments:
|
|
interface:
|
|
description: Specify interface to perform PCAP on.
|
|
type: String
|
|
default: Ethernet0
|
|
executor:
|
|
name: powershell
|
|
elevation_required: true
|
|
command: |
|
|
c:\Program Files\Wireshark\tshark.exe -i #{interface} -c 5
|
|
c:\windump.exe
|